633e80fa82a294fd2387d5e800d212ed90ce24227b80c400095664ebb6791adf

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14/10/2024, 21:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

444492407251fbdcf97ec1eef1419cd8_JaffaCakes118.html
Size

53KB
MD5

444492407251fbdcf97ec1eef1419cd8
SHA1

54c19d0e8b1ba5385ea75581e67c629b0b2e55f4
SHA256

633e80fa82a294fd2387d5e800d212ed90ce24227b80c400095664ebb6791adf
SHA512

26b40b269ab623d8935de27ad5eb02a4de55eb94a652f1bc83a25f0c4fd5513e8d1a12d2692c2e35209889cd0c028bf2accf681e02f69866b373bfc3b5465255
SSDEEP

1536:CkgUiIakTqGivi+PyU6runlYC63Nj+q5Vy0R0w2AzTICbbcof/t9M/dNwIUTDmD0:CkgUiIakTqGivi+PyU6runlYC63Nj+qt

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{51F64971-8A73-11EF-9EA5-F2BBDB1F0DCB} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30fda830801edb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea2200000000020000000000106600000001000020000000c0d372d18fedca840a63e230188b194f73c700647f308647b89c515a903b1f35000000000e800000000200002000000064a60f7395424371973e3223ad5fbdfc1f61c39758c593591508da3970250909200000003940742f581e5c3621d905f13508a9d6ba003f8cea714dc6e0d99ba9dc8a789a40000000b715f8f136661a69e31b1962ada1b698b4a9e33e9fb913e539a60e3361b4140b13c5e17c98e445395bf929af2cd57ec999973480011b00ddf417e11dc189e13c	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea220000000002000000000010660000000100002000000066ed08b67ab7b13d6e8ec95f2eed55d89d53c9730340f95fd2c46f4fd046299f000000000e8000000002000020000000e3f21ab6baa28c9fe975542eaa0b91c9464e327616c9b37cd70cf3ae28b1aa27900000001b9a03c6bd13275080ca1addbd5da6a8ac25708a9f3951f89004d4e1e5eaa4ba85a87651976746ca4cde58e1e3ff3b25b826b69de8c1ab2860e0b5499deee7c966c8393a535b402ddb09265dc6a2e259c9fd3a33557ee7f82132e7737dea4366f5302efc354e3f44532535ff5455d1304e6f1dc0e70f26b194a4e0c35b05fa4b96f093577962fb895a48c65ebd81e7ed400000000057dd4b808c3faadb31b6be068324087230107875912e6de69b5a291f27ba355ff77259f85afc687c89b2b9dc1e177442758923a22aa79599704d2fd7b38b32	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "435103205"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2348	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2348	iexplore.exe
2348	iexplore.exe
2328	IEXPLORE.EXE
2328	IEXPLORE.EXE
2328	IEXPLORE.EXE
2328	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 2328	2348	iexplore.exe	30
PID 2348 wrote to memory of 2328	2348	iexplore.exe	30
PID 2348 wrote to memory of 2328	2348	iexplore.exe	30
PID 2348 wrote to memory of 2328	2348	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\444492407251fbdcf97ec1eef1419cd8_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2348 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f2aae2990633eafa6c830eec8800c721

SHA1
393bc7c39d82d6e9ffe0d65986fc4861626bfce6

SHA256
8425ae5555474fe0fb067703c7f0cbbe24f86a4acd107194c8c1553769955849

SHA512
6c8e1b863286332baf1d0495f7ed12f8ea534f52012f6f4db9c5a0e1e4dff2b6eed34ba723de67c8941cf27449a79267a7784f9cc4262c339b9202211cabc9a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d747574570e9558a9e576dceb24c5c57

SHA1
514264270d12fa9178ffa51218e8497076f214c4

SHA256
1735ed41257d3307698a6e6ec9b689f0ac4d4be1ed77419c590cb7cfe1586236

SHA512
9a064ed32e62e6c2394edac31029b3af5963ce5b749a4c9cd3f261c394b11764e1611bfde2f42160ca012113d2c9406e753bfbfd6571b3657597db624c9cb4b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ca65dea1ff6136422351633b94c83bc5

SHA1
a472188d905ebb539f56a65d39b409a06652cfe8

SHA256
deb03bea9f85278fccdec29f95bda36c1e88110c9d9f806815bad8bb74cdb79b

SHA512
118145bc0602e82296e6e5c1b6c386e449140e0d1a7a21a82882d5053e8cf29906ab9ef4f19fb887f40bb5552039924501ceb2e20ed7369e07e56b253c79b806

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d327d0009f557c20aa284e9bcd88afdd

SHA1
cb9a2b110c416fdaa7c453cd3f06467167f67614

SHA256
9013ef8e8feb33e3bea83533e7a656dd99841d85fc66d3540030fad37f2baf80

SHA512
adba4263b8c2f2c32c9961d9d5c06be7e416602a47b3f00f08bb4974f017a05288eed7f661d8009e2cfae9c5bc74774f9093093a3fb7e22dae3756b07307c6f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7ec9e937958effdedbb12acb480afe0b

SHA1
c101a62666449a5cbe6dc125f83e789e9dac929f

SHA256
7ed9c98d0c777044b318c7b07c14678f0e4d176c50d628cbcd8d26a07c7b03f6

SHA512
c7236ccf368bc4dd501d8494158fb573e67bfe97114858314639ab5a7b1e32844b6e99ad37ea5dbafc96256739ea12e5826da453455f3ef59a4b15fa4e78236e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b7672607c3e243e0c7fb78c8cdc7fa6b

SHA1
9ea93c0f96d37dfd59fcfcfc7bc2cde6d6afe525

SHA256
b816fac6f95732bc1e0d4ef61087e5e52bbcd33a485b4949f885a35316659b15

SHA512
032d3f30a00fe7506a0d0b57f3590b1cf247fe89cc08ddaf2e655efa2d747a55d65d9b8d334dcf7984efd48ad46ba11e83264510cf317064a87f397a3a345333

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
45454874b978386e910eeb88ce6d48d5

SHA1
9318096d27b551b1a70fc44969da4b61f9c6eba7

SHA256
ed21f3a576cdc9a237e04f5976404489f812df954ec5a1a2fa1920648caf3b5d

SHA512
56076ee6736b99f3b354863af471a42408bc8c915722e2ab61404c8a4f5d70ff878caefa8f5ad830259a7fd5e58607386f646467dfcdb21de2eb08a4e380f39d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
777b0eec6d7dd4e7ae930c3436e0c75e

SHA1
dc975ce9c49cfa8f362b8db9571a81b39699747f

SHA256
9586d273a6ce470e271b4e9f580430c7483557b06a77fcdb2741b1b574530346

SHA512
b70675a7c8e67132e7117d71ab5168bc11f1b049f7b5fbfb1bbd1dedc5a06b3f12f4834456e1d5aec32301b79c9c031d00b6cda90ffe98257bb41a42096edbad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8bd99fdc304b5b4832f8d83f701dc841

SHA1
4de309e0103f68495e28715773314e92fd1548fd

SHA256
ae55b2ae7011ec221dd3d795567d99d69789ee08c6fbd9ce61869df5b61a6133

SHA512
11ae2918d54e368903f66399216310f5be4137ca3db4cb2b67f9fff200f766726287ae1ff54f2a4b968ededbf0a23e520cb53c3f3264253185ac9a6d13afab99

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c5a719c72a4385a12fce579b96d00f26

SHA1
fe318bfcbcd1728dc2ce595677644c76291636c5

SHA256
f965d2fa821cab8a7abf09432a68212614e2aff1fd6c190c40b76cea4711f16f

SHA512
c63b42f5e778f6643b5fae5e217484de480f1fe877f4d0b355fb0bf529bca827b585525c93b1eb23243fdb46b0569271d7af699ec2e5741c43eb3dc00e881b82

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
75e7c2833dcbb51737d758e65c24e4f9

SHA1
c56da8abc90179c074da5844d5b851d1cd782150

SHA256
8306ce63ac3269f53fcb73f1070db0a9bc284a495f890bb44a737c0230fb0bd9

SHA512
b3c4c4bc027762b9204069bb663c0018784144957409acd7b26292fb8e1c25fee04c47570620799c4c48291e63e41cfcd87525a09a73bbb09fe6668b12f2d711

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
760686131775834727888224601d894f

SHA1
4fab2902a1fb694e8c29ea84b5b07290c1883e90

SHA256
4f969af1625b1d37adef6c0c3d73fb225ba7beed2aa05d22d268fe3e7def3ee4

SHA512
16c0c4ac2c21993eebbe86bd782c5211f44762829c737d5b7431f5895cfd92c19baa99852dbbef7b2f9680ca45bdefe7d43673b403ade0a48fffe2a0c736db8e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MPUI9R2R\normal_post[1].htm

Filesize
706B

MD5
67f3a5933c17b3ab044826d3927d0ba9

SHA1
5957076d09bacaa6db8ddc832b4fd87ed8f05f8a

SHA256
97e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64

SHA512
03ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1D92.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1DB4.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit